Privacy
Privacy policy
Updated onOctober 04, 2026 · version2026-10-04
This policy explains what personal data this site collects, for what purpose, how long it is kept, and how you exercise your rights under Brazil’s General Data Protection Law (Lei nº 13.709/2018, the LGPD). The site is operated from Brazil, so Brazilian law applies regardless of the language you are reading.
It is written to be read, not to protect whoever wrote it. If anything here is unclear, ask — the contact is at the end.
Who the controller is
Vinícius Demian — Bar & Beverage Creative Services, São Paulo, Brazil.
For data protection matters, including the rights listed below, write to contato@viniciusdemian.com or message WhatsApp +55 11 99954-0041.
The same contact acts as data protection officer. Resolution CD/ANPD nº 2/2022 allows small agents to simplify this.
What is collected, and why
When you send the briefing form
| Data | What for |
|---|---|
| Name | Knowing who I am talking to |
| Venue, city, type of operation | Understanding the project before we talk |
| Format of interest, expected start | Preparing a proposal built for you |
| Free message | Whatever you want to tell me |
| WhatsApp and/or email | Replying. At least one is required — with no channel there is no way to get back to you |
Legal basis: preliminary procedures related to a contract, at the data subject’s request (LGPD, Art. 7, V). Put plainly: you asked for a proposal, and I need this data to prepare one and reply.
The acceptance box on the form is acknowledgement of this policy, not the legal basis for processing. That distinction matters: withdrawing it does not retroactively erase a commercial conversation you started yourself — but you can still ask for deletion at any time, as described below.
Along with the submission I automatically record where the visit came from (the page the form was sent from, and campaign parameters when present). It tells me what works; on its own it does not identify you.
When you click WhatsApp, Instagram or email
I record that a click happened, on which channel and from which page. No cookie, no identifier, no IP attached. It is a count, not tracking — and it is how I know whether the site is doing its job.
Measurement and advertising cookies
Only with your consent, given in the banner on your first visit. Until you accept, no third-party tag is loaded — not even as a network request.
If you accept, I load Google Tag Manager, which may activate Google measurement and advertising tools. You can change your mind whenever you like through the “Manage consent” link in the footer.
The site works in full without these cookies, the form included.
Measurement without cookies
I use Cloudflare Web Analytics, which measures visits with no cookie, no persistent identifier and no fingerprinting. Because it does not identify you, it does not depend on consent.
Who the data is shared with
I do not sell or trade your data. It passes through service providers acting on my behalf:
| Processor | Role | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, the contacts database and antispam protection (Turnstile) | USA |
| Resend (Plus Five Five, Inc.) | Sending the new-contact notification | USA |
| Google LLC | Tag Manager and measurement/advertising tools — only with consent | USA |
International transfer
These processors are outside Brazil, so there is an international transfer of data. It relies on standard contractual clauses under Resolution CD/ANPD nº 19/2024, incorporated into those providers’ service agreements.
The form is protected by Cloudflare Turnstile. Its use is subject to Cloudflare’s Turnstile Privacy Addendum.
How long it is kept
- Form contacts: up to 24 months after the last contact, unless it becomes a contractual relationship — in which case, for the applicable legal period.
- Click counts: aggregate data, with no personal identification.
- Cookie consent: 12 months, or until you change your choice.
After that period, the records are deleted.
Your rights
The LGPD (Art. 18) guarantees that you may request, at any time:
- confirmation that I process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymisation, blocking or deletion of unnecessary or excessive data;
- portability;
- deletion of data processed on the basis of your consent;
- information about who I have shared your data with;
- withdrawal of consent.
To exercise any of them, write to contato@viniciusdemian.com or message on WhatsApp. I reply within 15 days. There is no charge and I do not ask for a reason.
If you believe I have not resolved it, you may complain to Brazil’s National Data Protection Authority (ANPD).
Security
Contacts are held in a restricted-access database inside the project’s Cloudflare account. The new-contact notification is sent by email in plain text. The whole site is served over HTTPS, with a content security policy restricting what the page may load.
No system is impenetrable, but these are the controls in place.
Changes to this policy
If the text changes materially, the recorded version changes with it and the consent banner reappears — so you can decide again, with the new text in front of you.